CVE-2025-6024 - CVE House
Back to Database
Status published Medium CVE-2025-6024

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites

Vulnerability Description

The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6024

Credits & Attribution

No credits recorded in the NVD database.

References

More from WSO2

View All →
CVE-2025-9973
Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover
Medium 6.4
CVE-2025-9955
Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration
Medium 5.7
CVE-2025-9804
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Critical 9.6
CVE-2025-9312
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
Critical 9.8
CVE-2025-9152
Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
Critical 9.8

Affected Vendor

Affected Software

WSO2 API Manager, WSO2 Identity Server
Vulnerable Versions:
0, 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0, 5.10.0, 5.11.0

Timeline

Official Publish: April 16th, 2026
Last Modified: April 16th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact